Splunk Search

COnvert week number to the 1st date in that week

nikita012
New Member

Below is the data. Weeknum is the number of week where 01-05 are week numbers from 2019 and 40-44 are week numbers from 2018. I want to generate a chart for the same data with x-axis as the first date of each week number. Ex- 40 should be Oct 1, 2018 and 01 should be 30/12/2018. How do I do it?

week Total
01 3
02 2
03 1
04 1
05 3
40 4
41 9
42 4
43 5
44 10

0 Karma
1 Solution

niketn
Legend

@nikita012 please try one of my older answers https://answers.splunk.com/answers/637244/time-range-to-display-count-of-weekly.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

nikita012
New Member

alt text

Following is the code:-

| eval Dates=strptime(Date, "%m/%d/%Y")
| sort Dates
| eval Dates=strftime(Dates, "%d/%m/%Y")
| eval weeknum=strftime(relative_time(strptime(Dates,"%d/%m/%Y"),"@w2"),"%Y/%V")
| stats min(_time) as MinTime by weeknum
| eval MinTime=strftime(MinTime,"%m/%d/%Y")
| eval WeekStartDate=strftime(relative_time(strptime(MinTime,"%m/%d/%Y"),"-0w@w"),"%m/%d/%Y")

This code is not giving the start date of each weeknum. 2018/39 should be 01/10/2018. It's taking the start date of the current week. How should I reslove it?

0 Karma

niketn
Legend

@nikita012 please try one of my older answers https://answers.splunk.com/answers/637244/time-range-to-display-count-of-weekly.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nikita012
New Member

alt text

I applied the code and got year no./week no. on x-axis. Ex- 2018/39 where 2018 is the year no. and 39 is the week no. How can I get the first date of that week on x-axis. Can you please provide the code for it. Ex- 2019/01 should be 01/01/2019.

0 Karma

niketn
Legend

@nikita012 I am not sure how the post does not help with your current query?
Following is a run anywhere example which converts your time format data %Y/%U to %m/%d/%Y

index=_internal sourcetype=splunkd log_level!=ERROR component=Exec* 
| eval WeekOfYear=strftime(_time,"%Y/%U") 
| stats count as Errors min(_time) as MinTime by WeekOfYear 
| eval MinTime=strftime(MinTime,"%m/%d/%Y") 
| eval WeekStartDate=strftime(relative_time(strptime(MinTime,"%m/%d/%Y"),"-0w@w"),"%m/%d/%Y")
| table WeekStartDate Errors
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...